Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@signalk/set-system-time

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.9npmAmendedPublished

    Signal K set-system-time plugin vulnerable to RCE - Command Injection

    CVE-2026-23515 · GHSA-p8gp-2w28-mhwg

    Affected
    • npm @signalk/set-system-time < 1.5.0
    Fixed in
    1.5.0· Vendor fix available
    Issue
    A Command Injection vulnerability allows authenticated users with write permissions to execute arbitrary shell commands on the Signal K server when the set-system-time plugin is enabled. Unauthenticated users can also exploit this vulnerability if security is disabled on the Signal K server. This occurs due to unsafe construction of shell commands when processing navigation.datetime values received via WebSocket delta messages. Details Product: Signal K set-system-time plugin Repository: https://github.com/SignalK/set-system-time File: index.js, lines 60-71 The vulnerability has three components: 1. Unsanitized Input: The datetime value from navigation.datetime Signal K path is directly interpolated into a shell command without validation 2. Shell Execution: The command is executed via spawn('sh', ['-c', command]), which interprets shell metacharacters 3. Sudo Privileges: The plugin can execute with root privileges if sudo is misconfigured, instructions to limit passwordless…

    Recommended action: Upgrade to 1.5.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →